Suspicious
Suspect

147f5917aaa3b2edec514bd3b5d99c79

PE Executable
|
MD5: 147f5917aaa3b2edec514bd3b5d99c79
|
Size: 1.4 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
147f5917aaa3b2edec514bd3b5d99c79
Sha1
f5d5549d8a89ad40b42399978021374c786f7008
Sha256
1e06f8596434f32ae1a944e9bec938729e9420a3dfab02d087e4f25569e4c368
Sha384
25990e1fb6c724c564106d760b4d25cea0d3a895583cee72975fca4c269cc01a63ab7deba6de77b7de300ba9997f2660
Sha512
70647a972741d3bba536d1335dd60974f2de85f54acf28164e26ecb4e94c95b5dfd45d789dc7ad49637f11034efbee419e4e4b6cafdec6ac8c1aec0c8a41037c
SSDeep
24576:JM4nJDBTKdfrXz036GZZGs+WuOrmxqTSNMa1/a49Y7tSDttAPlsNwMlZbVAxK1hU:LgdHZGZMs+rnq+NMy/a49Y7M5tIW6ybA
TLSH
30553363BF18AD50E67331FCBA77E4420EB8D6AA844516DFCD98338721479962E830F5

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
UPolyX 0.3 -> delikon
File Structure
147f5917aaa3b2edec514bd3b5d99c79
[Authenticode]_af40dfd5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Oaifysmtvf.Properties.Resources.resources
Nqoljdzayg
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x151400 size 18872 bytes
Module Name

Ceketvutc
Full Name

Ceketvutc
EntryPoint

System.Void Oaifysmtvf.Oqsfhqnzyfk::Main()
Scope Name

Ceketvutc
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ceketvutc
Assembly Version

1.0.1095.20338
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Oaifysmtvf.Oqsfhqnzyfk::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Oaifysmtvf.Tntxwz::.ctor() stloc.0 <null> newobj System.Void Oaifysmtvf.Plifgj::.ctor() stloc.1 <null> newobj System.Void Oaifysmtvf.Ljlomdxiit::.ctor() stloc.2 <null> newobj System.Void Oaifysmtvf.Qsdorryc::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Oaifysmtvf.Jnozm::.ctor(Oaifysmtvf.Plifgj,Oaifysmtvf.Ljlomdxiit,Oaifysmtvf.Qsdorryc) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Zmnfvz(System.Object,Oaifysmtvf.Uqfzgwagiao) newobj System.Void System.EventHandler`1<Oaifysmtvf.Uqfzgwagiao>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Tntxwz::add_DownloadCompleted(System.EventHandler`1<Oaifysmtvf.Uqfzgwagiao>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Ywnwhwx(System.Object,Oaifysmtvf.Whpayx) newobj System.Void System.EventHandler`1<Oaifysmtvf.Whpayx>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Plifgj::add_DecryptionCompleted(System.EventHandler`1<Oaifysmtvf.Whpayx>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Vmyjfix(System.Object,Oaifysmtvf.Dsdxzp) newobj System.Void System.EventHandler`1<Oaifysmtvf.Dsdxzp>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Ljlomdxiit::add_LoadCompleted(System.EventHandler`1<Oaifysmtvf.Dsdxzp>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Mnibe(System.Object,Oaifysmtvf.Qtxjqz) newobj System.Void System.EventHandler`1<Oaifysmtvf.Qtxjqz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Qsdorryc::add_InvocationCompleted(System.EventHandler`1<Oaifysmtvf.Qtxjqz>) ldloc.0 <null> callvirt System.Void Oaifysmtvf.Tntxwz::Nofjsdnumqp() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Module Name

Ceketvutc
Full Name

Ceketvutc
EntryPoint

System.Void Oaifysmtvf.Oqsfhqnzyfk::Main()
Scope Name

Ceketvutc
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ceketvutc
Assembly Version

1.0.1095.20338
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Oaifysmtvf.Oqsfhqnzyfk::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Oaifysmtvf.Tntxwz::.ctor() stloc.0 <null> newobj System.Void Oaifysmtvf.Plifgj::.ctor() stloc.1 <null> newobj System.Void Oaifysmtvf.Ljlomdxiit::.ctor() stloc.2 <null> newobj System.Void Oaifysmtvf.Qsdorryc::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Oaifysmtvf.Jnozm::.ctor(Oaifysmtvf.Plifgj,Oaifysmtvf.Ljlomdxiit,Oaifysmtvf.Qsdorryc) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Zmnfvz(System.Object,Oaifysmtvf.Uqfzgwagiao) newobj System.Void System.EventHandler`1<Oaifysmtvf.Uqfzgwagiao>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Tntxwz::add_DownloadCompleted(System.EventHandler`1<Oaifysmtvf.Uqfzgwagiao>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Ywnwhwx(System.Object,Oaifysmtvf.Whpayx) newobj System.Void System.EventHandler`1<Oaifysmtvf.Whpayx>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Plifgj::add_DecryptionCompleted(System.EventHandler`1<Oaifysmtvf.Whpayx>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Vmyjfix(System.Object,Oaifysmtvf.Dsdxzp) newobj System.Void System.EventHandler`1<Oaifysmtvf.Dsdxzp>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Ljlomdxiit::add_LoadCompleted(System.EventHandler`1<Oaifysmtvf.Dsdxzp>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Oaifysmtvf.Jnozm::Mnibe(System.Object,Oaifysmtvf.Qtxjqz) newobj System.Void System.EventHandler`1<Oaifysmtvf.Qtxjqz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Oaifysmtvf.Qsdorryc::add_InvocationCompleted(System.EventHandler`1<Oaifysmtvf.Qtxjqz>) ldloc.0 <null> callvirt System.Void Oaifysmtvf.Tntxwz::Nofjsdnumqp() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
147f5917aaa3b2edec514bd3b5d99c79 (1.4 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙